@efoo/ccprofile 0.4.0 → 0.5.0

package/README.md

@@ -63,6 +63,22 @@ claude        # /status shows "Auth token: ANTHROPIC_AUTH_TOKEN"
 
 Repeat with `ccprofile add personal` etc. Different terminals in different directories run different accounts concurrently.
 
+### Checking status
+
+```sh
+ccprofile which   # which account does *this* shell/directory resolve to? (instant, no network)
+ccprofile usage   # per-account plan utilization + reset times, straight from claude.ai
+```
+
+`ccprofile which` (alias `whoami`) answers "who am I running as here?" from local
+signals only, in Claude Code's own precedence order: a provider override
+(`CLAUDE_CODE_USE_{BEDROCK,VERTEX,FOUNDRY}`) wins first if set, otherwise the
+exported `ANTHROPIC_AUTH_TOKEN` matched against your registered profiles, then the
+directory's `.envrc` link — so it returns immediately. `ccprofile usage` decrypts your Chrome claude.ai session cookies
+to fetch the real 5-hour / weekly / Fable-weekly utilization for every signed-in
+account, ordered by whichever weekly limit resets soonest — without opening or
+switching the browser (you just need to be signed in to claude.ai in Chrome).
+
 ## Commands
 
 | Command | Description |
@@ -71,9 +87,11 @@ Repeat with `ccprofile add personal` etc. Different terminals in different direc
 | `ccprofile list [--json]` | Profiles with token presence and expiry countdown |
 | `ccprofile link <name> [dir]` | Write the managed `.envrc` block and `direnv allow` |
 | `ccprofile unlink [dir]` | Remove the managed block (deletes `.envrc` if nothing else remains) |
+| `ccprofile which` | Show which account this shell/directory resolves to right now — instant, no probes (alias: `whoami`) |
 | `ccprofile token <name>` | Print the stored token to stdout (for scripting — handle with care) |
 | `ccprofile remove <name>` | Delete the profile and its Keychain entry |
 | `ccprofile doctor [dir]` | Diagnose provider overrides, stale/missing active token env, expiry, token liveness, usage limits (a minimal real inference per profile — fable first, haiku fallback), broken links. `--model <alias>` pins the probe model; `--offline` skips all server probes |
+| `ccprofile usage [--json]` | Per-account plan utilization (5-hour, weekly, and Fable-weekly) with reset times, read from claude.ai via your Chrome session — no browser open or switch needed |
 | `ccprofile completion <shell>` | Print a completion script for fish, zsh, or bash |
 
 ## Shell completion
@@ -118,9 +136,9 @@ Notes:
 
 ccprofile is built on `claude setup-token`, whose long-lived tokens are **deliberately scoped to inference only** ("for security reasons", per Claude Code's own `/doctor`). Several conveniences of a normal `/login` session are therefore unavailable in linked directories:
 
-- **No account identity introspection.** The token cannot answer "whose token is this?" — the OAuth profile endpoint rejects it (`user:profile` scope missing, see [#11985](https://github.com/anthropics/claude-code/issues/11985)). The `--email` you record is a self-declared label, not verified.
+- **No account identity introspection.** The token cannot answer "whose token is this?" — the OAuth profile endpoint rejects it (`user:profile` scope missing, see [#11985](https://github.com/anthropics/claude-code/issues/11985)). The `--email` you record is a self-declared label, not verified. (`ccprofile which` still names the *active* account, but locally — by matching the exported token against your registered profiles, never asking the server.)
   *Verify identity once, at registration time:* make sure the browser is logged into the intended claude.ai account before `claude setup-token`, then send a couple of prompts from a linked directory and confirm on claude.ai (web) that the intended account's usage moved.
-- **`/status` → Usage tab shows no plan utilization** in token-authenticated sessions (same scope restriction — the usage endpoint also requires `user:profile`). Check usage on claude.ai, or run `ccprofile doctor`: it detects exhausted usage limits the only way these tokens allow, by sending one minimal real inference per profile (fable first; on a fable limit it retries with haiku to tell "fable's separate budget exhausted" from "subscription window exhausted"). The probe consumes a negligible amount of quota and starts the 5-hour window of an idle profile; use `--offline` if you don't want that.
+- **`/status` → Usage tab shows no plan utilization** in token-authenticated sessions (same scope restriction — the usage endpoint also requires `user:profile`). Check usage on claude.ai, or run `ccprofile doctor`: it detects exhausted usage limits the only way these tokens allow, by sending one minimal real inference per profile (fable first; on a fable limit it retries with haiku to tell "fable's separate budget exhausted" from "subscription window exhausted"). The probe consumes a negligible amount of quota and starts the 5-hour window of an idle profile; use `--offline` if you don't want that. To read *real* remaining quota without spending any, run `ccprofile usage`, which pulls per-account utilization straight from claude.ai using your signed-in Chrome session (no token probe, no window started).
 - **Remote Control is unavailable** in linked directories. Claude Code treats `ANTHROPIC_AUTH_TOKEN` sessions as API-key authentication, while Remote Control requires claude.ai subscription authentication.
 - **Tokens last up to 1 year but can die earlier** (password change, logout-all). The recorded expiry is a hint, not a guarantee — `ccprofile doctor` probes the server and tells live tokens apart from revoked ones.
 - **Routing only applies to shell-launched processes.** direnv activates the token when a hooked shell enters the directory; apps launched outside a hooked shell (GUI launchers) bypass it.

package/dist/commands/completion.js

@@ -4,6 +4,7 @@ export const SUBCOMMANDS = [
     { name: "list", description: "Show profiles, token presence, and expiry" },
     { name: "link", description: "Route a directory to a profile" },
     { name: "unlink", description: "Remove the managed .envrc block" },
+    { name: "which", description: "Show which account this shell resolves to" },
     { name: "token", description: "Print the stored token" },
     { name: "remove", description: "Delete a profile and its Keychain entry" },
     { name: "doctor", description: "Diagnose configuration problems" },

package/dist/commands/doctor.js

@@ -51,6 +51,13 @@ export async function doctorCommand(argv) {
             problems += 1;
         }
     }
+    const config = loadConfig();
+    const keychain = new Keychain();
+    // Answer "which account is active here?" up front — it is cheap (one .envrc
+    // read plus at most one Keychain lookup) and is the thing users most often
+    // open doctor to check, so it must not sit behind the slow per-profile
+    // inference probes further down.
+    problems += await reportCurrentLink(dir, config, keychain);
     for (const envVar of OVERRIDING_ENV_VARS) {
         if (process.env[envVar] !== undefined) {
             console.log(fail(`${envVar} is set: it overrides ANTHROPIC_AUTH_TOKEN and bypasses ccprofile routing.`));
@@ -72,8 +79,6 @@ export async function doctorCommand(argv) {
             warnings += 1;
         }
     }
-    const config = loadConfig();
-    const keychain = new Keychain();
     const profiles = Object.entries(config.profiles);
     if (profiles.length > 0) {
         const ctx = {
@@ -105,44 +110,6 @@ export async function doctorCommand(argv) {
         }
         spinner.stop();
     }
-    const envrcPath = join(dir, ".envrc");
-    if (existsSync(envrcPath)) {
-        console.log();
-        const linked = parseLinkedProfile(readFileSync(envrcPath, "utf8"));
-        if (linked === null) {
-            console.log(ok(`${envrcPath} exists but has no ccprofile block (not managed here).`));
-        }
-        else if (config.profiles[linked]) {
-            if (dir !== resolve(process.cwd())) {
-                console.log(ok(`${bold(dir)} → profile "${linked}"`));
-            }
-            else {
-                const linkedProfile = config.profiles[linked];
-                const exportedToken = process.env.ANTHROPIC_AUTH_TOKEN;
-                if (exportedToken === undefined) {
-                    console.log(fail(`This directory → profile "${linked}", but ANTHROPIC_AUTH_TOKEN is not exported in this shell. Run: direnv reload`));
-                    problems += 1;
-                }
-                else {
-                    const linkedToken = await keychain.getToken(linkedProfile.keychain.service, linkedProfile.keychain.account);
-                    if (linkedToken !== null && exportedToken !== linkedToken) {
-                        console.log(fail(`This directory → profile "${linked}", but this shell exports a different ANTHROPIC_AUTH_TOKEN. Run: direnv reload, then restart Claude Code.`));
-                        problems += 1;
-                    }
-                    else if (linkedToken !== null) {
-                        console.log(ok(`This directory → profile "${linked}" (ANTHROPIC_AUTH_TOKEN exported)`));
-                    }
-                    else {
-                        console.log(ok(`This directory → profile "${linked}"`));
-                    }
-                }
-            }
-        }
-        else {
-            console.log(fail(`${envrcPath} references unknown profile "${linked}". Run: ccprofile link <profile> ${dir}`));
-            problems += 1;
-        }
-    }
     console.log();
     if (problems > 0) {
         console.log(fail(`${problems} problem(s), ${warnings} warning(s).`));
@@ -151,6 +118,63 @@ export async function doctorCommand(argv) {
     console.log(ok(`No problems found (${warnings} warning(s)).`));
     return 0;
 }
+/**
+ * Prints the "which account does this directory resolve to?" summary and
+ * returns how many problems it found. Kept intentionally cheap — one .envrc
+ * read plus at most one Keychain lookup — so it can run before the inference
+ * probes and give an instant answer.
+ */
+async function reportCurrentLink(dir, config, keychain) {
+    const envrcPath = join(dir, ".envrc");
+    let content;
+    try {
+        if (!existsSync(envrcPath))
+            return 0;
+        content = readFileSync(envrcPath, "utf8");
+    }
+    catch {
+        // The .envrc vanished between the check and the read, or is unreadable —
+        // nothing to report, and doctor must not crash over a transient FS error.
+        return 0;
+    }
+    console.log();
+    const linked = parseLinkedProfile(content);
+    if (linked === null) {
+        console.log(ok(`${envrcPath} exists but has no ccprofile block (not managed here).`));
+        return 0;
+    }
+    const linkedProfile = config.profiles[linked];
+    if (linkedProfile === undefined) {
+        console.log(fail(`${envrcPath} references unknown profile "${linked}". Run: ccprofile link <profile> ${dir}`));
+        return 1;
+    }
+    if (dir !== resolve(process.cwd())) {
+        console.log(ok(`${bold(dir)} → profile "${linked}"`));
+        return 0;
+    }
+    const exportedToken = process.env.ANTHROPIC_AUTH_TOKEN;
+    if (exportedToken === undefined) {
+        console.log(fail(`This directory → profile "${linked}", but ANTHROPIC_AUTH_TOKEN is not exported in this shell. Run: direnv reload`));
+        return 1;
+    }
+    let linkedToken = null;
+    try {
+        linkedToken = await keychain.getToken(linkedProfile.keychain.service, linkedProfile.keychain.account);
+    }
+    catch {
+        // A Keychain hiccup (e.g. `security` failing) must not abort doctor; fall
+        // back to reporting the link without the token-match confirmation.
+        linkedToken = null;
+    }
+    if (linkedToken !== null && exportedToken !== linkedToken) {
+        console.log(fail(`This directory → profile "${linked}", but this shell exports a different ANTHROPIC_AUTH_TOKEN. Run: direnv reload, then restart Claude Code.`));
+        return 1;
+    }
+    console.log(linkedToken !== null
+        ? ok(`This directory → profile "${linked}" (ANTHROPIC_AUTH_TOKEN exported)`)
+        : ok(`This directory → profile "${linked}"`));
+    return 0;
+}
 const HEADER = ["PROFILE", "TOKEN", "EXPIRES", "FABLE", "OTHERS", "NOTE"];
 // The cell vocabulary is fixed, so column widths are known before any check
 // resolves — rows can stream in as profiles finish, without a barrier.

package/dist/commands/which.js

@@ -0,0 +1,114 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { loadConfig } from "../lib/config.js";
+import { parseLinkedProfile } from "../lib/envrc.js";
+import { assertDarwin, Keychain } from "../lib/keychain.js";
+import { OVERRIDING_ENV_VARS } from "../lib/usage.js";
+import { bold, cyan, dim, fail, ok, warn } from "../lib/format.js";
+/**
+ * `ccprofile which` answers one question fast: which account will Claude Code
+ * use in this shell, right now? Unlike `doctor` it runs no inference probes and
+ * no liveness checks — just the local signals (env vars, the exported token,
+ * and the current directory's link) — so it returns effectively instantly.
+ */
+export async function whichCommand(argv) {
+    parseArgs({ args: argv, allowPositionals: true, options: {} });
+    assertDarwin();
+    const config = loadConfig();
+    const overrideVar = OVERRIDING_ENV_VARS.find((v) => process.env[v] !== undefined);
+    const exportedToken = process.env.ANTHROPIC_AUTH_TOKEN;
+    const linkName = readCwdLink();
+    const linkIsKnown = linkName !== null && config.profiles[linkName] !== undefined;
+    // The Keychain read is the only I/O with a cost, and only when a token is
+    // actually exported — resolving it back to a profile name.
+    let matchedProfile = null;
+    if (overrideVar === undefined && exportedToken !== undefined && exportedToken !== "") {
+        matchedProfile = await findProfileByToken(config, exportedToken);
+    }
+    const result = classifyActiveAccount({
+        overrideVar,
+        exportedToken,
+        linkName,
+        linkIsKnown,
+        matchedProfile,
+    });
+    return printResult(result, config);
+}
+/**
+ * Pure resolution of "who am I running as" from the local signals, mirroring
+ * Claude Code's own precedence: an override env var wins; otherwise the
+ * exported ANTHROPIC_AUTH_TOKEN decides; with no token, a directory link is
+ * merely configured (not active) and bare shells use /login.
+ */
+export function classifyActiveAccount(input) {
+    if (input.overrideVar !== undefined) {
+        return { kind: "override", envVar: input.overrideVar };
+    }
+    if (input.exportedToken === undefined || input.exportedToken === "") {
+        if (input.linkName !== null && input.linkIsKnown) {
+            return { kind: "link-inactive", profile: input.linkName };
+        }
+        return { kind: "none" };
+    }
+    if (input.matchedProfile === null) {
+        return { kind: "foreign" };
+    }
+    return {
+        kind: "active",
+        profile: input.matchedProfile,
+        viaLink: input.linkName === input.matchedProfile,
+        linkMismatch: input.linkName !== null && input.linkName !== input.matchedProfile ? input.linkName : null,
+    };
+}
+function printResult(result, config) {
+    switch (result.kind) {
+        case "override":
+            console.log(fail(`${result.envVar} is set — Claude Code ignores ccprofile routing and uses it instead.`));
+            return 1;
+        case "active": {
+            const email = config.profiles[result.profile]?.email;
+            console.log(`${cyan(bold(result.profile))}${email ? `  ${dim(`(${email})`)}` : ""}`);
+            const sources = result.viaLink
+                ? [".envrc link", "ANTHROPIC_AUTH_TOKEN exported"]
+                : ["ANTHROPIC_AUTH_TOKEN exported"];
+            console.log(dim(`  source: ${sources.join(" · ")}`));
+            if (result.linkMismatch !== null) {
+                console.log(warn(`  This directory links "${result.linkMismatch}", but the exported token is "${result.profile}". Run: direnv reload`));
+            }
+            return 0;
+        }
+        case "foreign":
+            console.log(warn("An ANTHROPIC_AUTH_TOKEN is exported, but it matches no ccprofile profile."));
+            console.log(dim("  It was likely set manually or by another tool."));
+            return 0;
+        case "link-inactive":
+            console.log(warn(`This directory links profile ${bold(result.profile)}, but no token is exported here.`));
+            console.log(dim("  Run: direnv reload  (or re-enter the directory) to activate it."));
+            return 1;
+        case "none":
+            console.log(ok(dim("No ccprofile account active — Claude Code uses your /login (subscription) session.")));
+            return 0;
+    }
+}
+function readCwdLink() {
+    const envrcPath = join(resolve(process.cwd()), ".envrc");
+    if (!existsSync(envrcPath))
+        return null;
+    try {
+        return parseLinkedProfile(readFileSync(envrcPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** Finds the profile whose stored Keychain token equals the exported one. */
+async function findProfileByToken(config, token) {
+    const keychain = new Keychain();
+    for (const [name, profile] of Object.entries(config.profiles)) {
+        const stored = await keychain.getToken(profile.keychain.service, profile.keychain.account);
+        if (stored !== null && stored === token)
+            return name;
+    }
+    return null;
+}

package/dist/index.js

@@ -20,6 +20,8 @@ ${bold("Commands")}
   list [--json]           Show profiles, token presence, and expiry
   link <name> [dir]       Route a directory to a profile (writes .envrc, direnv allow)
   unlink [dir]            Remove the managed block from a directory's .envrc
+  which                   Show which account this shell/directory resolves to,
+                          instantly (no probes). Alias: whoami
   token <name>            Print the stored token (for scripting; handle with care)
   remove <name> [--force] Delete a profile and its Keychain entry
   doctor [dir]            Diagnose overriding env vars, expiry, token liveness,
@@ -51,6 +53,9 @@ async function main() {
             return (await import("./commands/link.js")).linkCommand(rest);
         case "unlink":
             return (await import("./commands/unlink.js")).unlinkCommand(rest);
+        case "which":
+        case "whoami":
+            return (await import("./commands/which.js")).whichCommand(rest);
         case "token":
             return (await import("./commands/token.js")).tokenCommand(rest);
         case "doctor":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efoo/ccprofile",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Per-directory Claude Code account routing via ANTHROPIC_AUTH_TOKEN, direnv, and macOS Keychain",
   "type": "module",
   "packageManager": "pnpm@10.33.4",